Implementation Objective
Define a repeatable risk decision model that guides prioritization, treatment selection, and executive accountability.
NIST CSF 2.0 Category
GV.RM Risk Management Strategy
GV Govern | Set risk appetite and treatment methods that leadership and operations can apply consistently.
Implementation Actions
- Define risk scoring criteria.
- Standardize treatment options and approvals.
- Run recurring risk governance reviews.
Evidence Examples
- Risk methodology
- Risk register
- Risk acceptance records
Suggested Metrics
- High-risk items past SLA
- Risk decision review completion rate
Framework Crosswalk
Direct mappings for this CSF category into NIST SP 800-171 family sections and CIS Controls v8 implementation domains.